gsadmin/Firelink
1
0
Fork 0
mirror of https://github.com/nimbold/Firelink.git synced 2026-07-27 04:19:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(release): harden package and engine verifier cleanup

Browse Source
This commit is contained in:
NimBold
2026-07-15 08:40:12 +03:30
parent 1da0fa7223
commit 4a3fece22b
3 changed files with 75 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/verify-linux-packages.node-test.js
+14 -1
View File
@@ -1,7 +1,7 @@
import assert from 'node:assert/strict';
import test from 'node:test';
import { parseDebianPackagePath } from './verify-linux-packages.js';
import { isSafePackagePath, parseDebianPackagePath } from './verify-linux-packages.js';
test('parses current dpkg-deb listings without a ./ prefix', () => {
assert.equal(
@@ -17,6 +17,19 @@ test('parses legacy dpkg-deb listings with a ./ prefix', () => {
);
});
test('accepts the package root in legacy dpkg-deb listings', () => {
assert.equal(
parseDebianPackagePath('drwxr-xr-x root/root 0 2026-07-12 07:24 ./'),
''
);
assert.equal(isSafePackagePath(''), true);
});
test('rejects paths outside the package usr tree', () => {
assert.equal(isSafePackagePath('../tmp/firelink'), false);
assert.equal(isSafePackagePath('etc/firelink'), false);
});
test('rejects malformed dpkg-deb listing lines', () => {
assert.throws(
() => parseDebianPackagePath('not a dpkg-deb listing'),